International News

FBI Deals Blow to Chinese Hacking Operation with Seizure of Tools

Published
Updated

By TaiwanPlus

Open in App

The FBI says it's seized phishing and scanning tools used by a Chinese hacking campaign called "Flax Typhoon" that targeted infrastructure in the US, Taiwan and beyond.

FBI Seizes Chinese Hacking Tools

REPORTER:  
The FBI has seized cyber hacking tools used by a Beijing-affiliated group that had targeted Taiwanese universities and energy infrastructure. Analysts say the campaign, known as “Flax Typhoon,” is difficult to track.

Chen Yun-neng (NATIONAL TAIWAN UNIVERSITY):  
The malicious program hides in an existing management software and uses legitimate software for malicious acts. For instance, it can download your data and export it, making it harder to detect because you won’t see any additional programs running, just the original programs already there.

REPORTER:  
Other targets included US energy infrastructure, airports in Japan and Poland, and several international NGOs. The US says a previously sanctioned Chinese firm was working with Flax Typhoon hackers to help them access vulnerabilities. The US expects the loss of important cyber tools will hamper the group’s ability to continue attacks.

The tools at issue, called “Microscan” and “FishHub,” were used by the hackers to scan, phish, and hack targets that included U.S. and foreign critical infrastructure. The tools were used to target, among other entities, an unnamed power company in the U.S., Japanese and Polish airports, Taiwanese universities, a multinational nongovernmental organization, and Taiwanese critical infrastructure companies.

The latest operation has rendered the tools inoperable in what FBI and Justice Department officials said was a blow to the hacking operation.

“We aim to remove the capability from the threat actors. We target their infrastructure, their money, and their tools,” FBI Cyber Division Deputy Assistant Director Jason Bilnoski told The Associated Press, calling the hacking operation “indiscriminate and reckless.”

The tools were operated by a Chinese-based information security company called Integrity Technology Group, which the FBI has said is closely associated with the Chinese government and is the actual identity of Flax Typhoon.